text input validation

Hello,

I have been warned that anything can be inserted in the input field, including db queries and there was a demonstration that this could actually open an account to third parties (by chaining it with other tricks). At the moment the only validation possible is number or email, but I guess we need to be able to restrict the character set in order to avoid this kind of intrusion.
Any suggestion, please?

Best regards